@intentius/chant 0.100.0 → 0.102.0

package/dist/workspace/template-manifest.d.ts

@@ -26,9 +26,12 @@
  * the merge base and the target version, so an unedited file carrying a value
  * still has its recorded hash.
  *
- * `hostBound` is declared and validated but not acted on yet: recording a
- * value per host belongs to export and import (#2552). A host-bound value is
- * recorded in `parameters` like any other until then.
+ * A parameter marked `hostBound` holds a value that differs per host, such
+ * as the domain a hosted service serves the app on. Its value is recorded in
+ * `parameters` like any other, and the lineage also records, under
+ * `hostBound`, the files whose template text carries it, so `chant workspace
+ * export` can switch the value for the export and `import` can switch it
+ * back without fetching the template (#2552).
  */
 import { z } from "zod";
 import { LockError } from "./lineage-lock.js";
@@ -86,5 +89,10 @@ export declare function substituteParameters(files: Map<string, Buffer>, manifes
  * one it adds. A recorded parameter the version no longer declares is dropped.
  */
 export declare function carryParameters(manifest: TemplateManifest | null, recorded: Record<string, unknown>): Record<string, string>;
+/**
+ * The host-bound parameters of a template (#2552), each with the listed files
+ * whose text carries its placeholder. Undefined when the template declares none.
+ */
+export declare function hostBoundFiles(files: Map<string, Buffer>, manifest: TemplateManifest | null): Record<string, string[]> | undefined;
 export {};
 //# sourceMappingURL=template-manifest.d.ts.map

package/dist/workspace/template-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-manifest.d.ts","sourceRoot":"","sources":["../../src/workspace/template-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAOvD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,QAAA,MAAM,eAAe;;;;;;kBAUV,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAEhE,QAAA,MAAM,cAAc;;;;;;;;;;kBAMT,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM9D,qBAAa,sBAAuB,SAAQ,SAAS;IAC1C,IAAI,SAA4B;CAC1C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAoChF;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU9E;AAOD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB1H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBrB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO5H"}
+{"version":3,"file":"template-manifest.d.ts","sourceRoot":"","sources":["../../src/workspace/template-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAOvD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,QAAA,MAAM,eAAe;;;;;;kBAUV,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAEhE,QAAA,MAAM,cAAc;;;;;;;;;;kBAMT,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM9D,qBAAa,sBAAuB,SAAQ,SAAS;IAC1C,IAAI,SAA4B;CAC1C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAoChF;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU9E;AAOD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB1H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBrB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO5H;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CASlI"}

package/dist/workspace/trailer-joins.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Joining a commit through chant's own trailers (#3149, ws-075), for `graph
+ * --intent` and `graph --intent --record`.
+ *
+ * A plugin's `commitJoins` reads a kind's own trailers (`intent-joins.ts`).
+ * These are core's: a `Chant-Record` names a record by kind and id, and a
+ * `Chant-Lease` names a work lease by its fencing token, which the lease
+ * histories on `chant/lifecycle` turn into the work item it was taken on.
+ * Both read the local branch and never fetch.
+ */
+import { type AppliedTrailers, type ChantTrailers } from "./trailers.js";
+/** What chant's trailers on one commit join it to, as a commit in `graph --intent` reports it. */
+export interface CommitTrailerJoins {
+    /** `Chant-Agent`: the agent session that wrote the commit. */
+    agent: string | null;
+    /** `Chant-Lease`: the work lease's token, and the work item a lease history on `chant/lifecycle` names for it, or null when none does. */
+    lease: {
+        token: string;
+        item: string | null;
+    } | null;
+    /** `Chant-Run`: the agent run that made the commit. */
+    run: string | null;
+    /** Each `Chant-Record`, with the id of its node in the graph, or null when no kind read has the record. */
+    records: {
+        kind: string;
+        id: string;
+        node: string | null;
+    }[];
+    /** The `Chant-Applied-*` trailers of a commit that applied a leased branch. */
+    applied: AppliedTrailers | null;
+}
+/**
+ * The work item each lease token names, from the lease histories
+ * (`_leases/<item>.jsonl`, any member's) on the local `chant/lifecycle`
+ * branch. A token no history names is left out. Never fetches.
+ */
+export declare function leaseItemsByToken(top: string, tokens: string[]): Map<string, string>;
+/** Read chant's trailers from each commit, and the work items their lease tokens name. */
+export declare function readTrailerJoins(top: string, commits: {
+    sha: string;
+    trailers: Record<string, string[]>;
+}[]): Map<string, {
+    trailers: ChantTrailers;
+    joins: CommitTrailerJoins;
+}>;
+//# sourceMappingURL=trailer-joins.d.ts.map

package/dist/workspace/trailer-joins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trailer-joins.d.ts","sourceRoot":"","sources":["../../src/workspace/trailer-joins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAqB,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAKzF,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0IAA0I;IAC1I,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACrD,uDAAuD;IACvD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,2GAA2G;IAC3G,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAC7D,+EAA+E;IAC/E,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;CACjC;AAUD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAapF;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAoBjL"}

package/dist/workspace/trailers.d.ts

@@ -0,0 +1,89 @@
+/**
+ * chant's commit trailers (#3149, ws-075): the vocabulary a commit uses to
+ * name the lease, the agent run, the records and the apply behind it.
+ *
+ * A trailer is how a commit points at a fact kept elsewhere: a work lease on
+ * `chant/lifecycle`, an agent run in the run ledger (#3033), a record in the
+ * working tree. Provenance is keyed to those ids, never to commit SHAs, so a
+ * commit that keeps its message through a rebase or a cherry-pick keeps its
+ * joins (#3037). chant never writes a commit itself (ws-074): whoever makes
+ * the commit adds the trailers, and chant reads them back in `graph
+ * --intent`, `graph --intent --record` and `workspace runs`.
+ *
+ * | Trailer | Value | Names |
+ * |---|---|---|
+ * | `Chant-Agent` | an agent session | the session that wrote the commit (ws-067) |
+ * | `Chant-Lease` | a fencing token | the work lease the commit was made under |
+ * | `Chant-Run` | a run id | the agent run that made the commit (#3033) |
+ * | `Chant-Record` | `<kind>:<id>` | a record the commit carries out or changes; repeatable |
+ * | `Chant-Applied-By` | a principal | who applied a leased branch, on the apply commit |
+ * | `Chant-Applied-At` | ISO 8601 | when it was applied |
+ * | `Chant-Applied-Commit` | a commit id | the tip of the branch that was applied |
+ *
+ * Every other trailer is a plugin's, and core gives it no meaning; a kind's
+ * `commitJoins` may (`intent-joins.ts`).
+ */
+/** The agent session that wrote a commit (ws-067). */
+export declare const AGENT_TRAILER = "Chant-Agent";
+/** The fencing token of the work lease a commit was made under. */
+export declare const LEASE_TRAILER = "Chant-Lease";
+/** The agent run that made a commit (#3033). */
+export declare const RUN_TRAILER = "Chant-Run";
+/** A record a commit carries out or changes, as `<kind>:<id>`. Repeatable. */
+export declare const RECORD_TRAILER = "Chant-Record";
+/** Who applied a leased branch, on the commit that applied it. */
+export declare const APPLIED_BY_TRAILER = "Chant-Applied-By";
+/** When the branch was applied, ISO 8601. */
+export declare const APPLIED_AT_TRAILER = "Chant-Applied-At";
+/** The tip of the branch that was applied. */
+export declare const APPLIED_COMMIT_TRAILER = "Chant-Applied-Commit";
+/** Every trailer key core reads, in the order a writer should add them. */
+export declare const CHANT_TRAILERS: readonly ["Chant-Agent", "Chant-Lease", "Chant-Run", "Chant-Record", "Chant-Applied-By", "Chant-Applied-At", "Chant-Applied-Commit"];
+/** One `Chant-Record` value. */
+export interface RecordRef {
+    /** The record kind's name, such as `decision` or `work`. */
+    kind: string;
+    id: string;
+}
+/** An apply, from the `Chant-Applied-*` trailers. */
+export interface AppliedTrailers {
+    by: string;
+    /** ISO 8601, or null when the trailer is missing. */
+    at: string | null;
+    /** The applied branch's tip, or null when the trailer is missing or is not a commit id. */
+    commit: string | null;
+}
+/** What chant's own trailers on one commit say. */
+export interface ChantTrailers {
+    agent: string | null;
+    lease: string | null;
+    run: string | null;
+    /** Each well-formed `Chant-Record` value, in order, without repeats. */
+    records: RecordRef[];
+    applied: AppliedTrailers | null;
+}
+/** Parse one `Chant-Record` value, `<kind>:<id>`, or undefined when it is not one. */
+export declare function parseRecordRef(value: string): RecordRef | undefined;
+/** Read chant's own trailers from a commit's parsed trailers. Keys compare without case, as git's do. */
+export declare function readChantTrailers(trailers: Record<string, string[]>): ChantTrailers;
+/** Whether a commit carries any of chant's own trailers. */
+export declare function hasChantTrailers(t: ChantTrailers): boolean;
+/** What a writer passes to {@link formatChantTrailers}. */
+export interface ChantTrailerInput {
+    agent?: string;
+    lease?: string;
+    run?: string;
+    records?: (RecordRef | string)[];
+    applied?: {
+        by: string;
+        at?: string;
+        commit?: string;
+    };
+}
+/**
+ * The trailer lines for a commit message, in {@link CHANT_TRAILERS} order.
+ * Throws when a value holds a line break or a record ref is malformed, since
+ * either would write a trailer git parses differently.
+ */
+export declare function formatChantTrailers(input: ChantTrailerInput): string[];
+//# sourceMappingURL=trailers.d.ts.map

package/dist/workspace/trailers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trailers.d.ts","sourceRoot":"","sources":["../../src/workspace/trailers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,sDAAsD;AACtD,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,mEAAmE;AACnE,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,gDAAgD;AAChD,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,8EAA8E;AAC9E,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAC7C,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AACrD,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AACrD,8CAA8C;AAC9C,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAE7D,2EAA2E;AAC3E,eAAO,MAAM,cAAc,sIAAuI,CAAC;AAQnK,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,qDAAqD;IACrD,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wEAAwE;IACxE,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;CACjC;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAMnE;AAED,yGAAyG;AACzG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,aAAa,CAenF;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,aAAa,GAAG,OAAO,CAE1D;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,CAAC,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAuBtE"}

package/dist/workspace/trust/attestor.d.ts

@@ -51,6 +51,12 @@ export interface CommitAttestor {
     /** A stable name, such as `ssh-commit`. */
     readonly name: string;
     attestCommit(ctx: AttestorContext, commit: string): CommitAttestation;
+    /**
+     * Judge a commit object that is not in this repository, given its raw bytes
+     * (`git cat-file commit` output), such as one a return carries (#2552).
+     * Optional: an attestor without it is not asked.
+     */
+    attestRaw?(ctx: AttestorContext, raw: Buffer): CommitAttestation;
 }
 /** Add an attestor. Later registrations are asked after earlier ones. */
 export declare function registerAttestor(attestor: CommitAttestor): void;
@@ -62,6 +68,8 @@ export declare function resetAttestors(): void;
  * can check is still reported as there.
  */
 export declare function attestCommit(ctx: AttestorContext, commit: string, attestors: readonly CommitAttestor[]): CommitAttestation;
+/** {@link attestCommit} for a raw commit object, asking only the attestors that judge one. */
+export declare function attestRawCommit(ctx: AttestorContext, raw: Buffer, attestors: readonly CommitAttestor[]): CommitAttestation;
 /** The attestors in use: the built-in ones first, then any registered. */
 export declare function activeAttestors(): Promise<CommitAttestor[]>;
 //# sourceMappingURL=attestor.d.ts.map

package/dist/workspace/trust/attestor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestor.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/attestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,8EAAsF,CAAC;AACrH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,4BAA4B,GAAG,YAAY,CAAC;IAChE,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC;CACvE;AAID,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,iBAAiB,CAQ1H;AAED,0EAA0E;AAC1E,wBAAsB,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAGjE"}
+{"version":3,"file":"attestor.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/attestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,YAAI,UAAU,EAAE,4BAA4B,EAAE,SAAS,eAA+B,CAAC;AACrH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,4BAA4B,GAAG,YAAY,CAAC;IAChE,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC;IACtE;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC;CAClE;AAID,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,iBAAiB,CAQ1H;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,iBAAiB,CAM1H;AAED,0EAA0E;AAC1E,wBAAsB,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAGjE"}

package/dist/workspace/trust/dsse.d.ts

@@ -0,0 +1,58 @@
+/**
+ * DSSE envelopes (https://github.com/secure-systems-lab/dsse, v1) signed with
+ * Ed25519 runner keys (#2553).
+ *
+ * The signature covers the pre-authentication encoding (PAE) of the payload
+ * type and the payload, never the payload alone, so an envelope cannot be
+ * replayed under another type. Everything here runs offline: verifying needs
+ * the envelope and the public key, nothing else.
+ *
+ * Public keys are written the way ssh writes them (`ssh-ed25519 AAAA...`), so
+ * the runner keys in `.chant/trust.json` read like the signers file beside
+ * them, and a key id is the key's ssh fingerprint (`SHA256:...`).
+ */
+import { type KeyObject } from "node:crypto";
+export declare const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+export interface DsseSignature {
+    keyid: string;
+    sig: string;
+}
+export interface DsseEnvelope {
+    payloadType: string;
+    /** Base64 of the payload bytes. */
+    payload: string;
+    signatures: DsseSignature[];
+}
+/** DSSE v1 pre-authentication encoding. Lengths are byte lengths in ASCII decimal. */
+export declare function pae(payloadType: string, payload: Buffer): Buffer;
+/** The 32 raw bytes of an `ssh-ed25519 <base64>` public key. */
+export declare function ed25519FromSsh(line: string): Buffer;
+/** An `ssh-ed25519 <base64>` line for 32 raw public key bytes. */
+export declare function sshFromEd25519(raw: Buffer): string;
+/** The ssh fingerprint of a public key line: `SHA256:` and unpadded base64. */
+export declare function sshFingerprint(line: string): string;
+/** A private Ed25519 key from PEM (PKCS#8), and its public half as an ssh line. */
+export declare function loadRunnerKey(pem: string): {
+    key: KeyObject;
+    publicKey: string;
+};
+export declare function signEnvelope(payloadType: string, payload: Buffer, key: KeyObject, publicKey: string): DsseEnvelope;
+export interface TrustedKey {
+    principal: string;
+    /** `ssh-ed25519 <base64>`. */
+    key: string;
+}
+export type EnvelopeVerdict = {
+    ok: true;
+    principal: string;
+    keyid: string;
+    payloadType: string;
+    payload: Buffer;
+} | {
+    ok: false;
+    code: "envelope-invalid" | "envelope-untrusted";
+    reason: string;
+};
+/** Verify an envelope against `trusted`. One valid signature by a trusted key is enough. */
+export declare function verifyEnvelope(envelope: unknown, trusted: readonly TrustedKey[]): EnvelopeVerdict;
+//# sourceMappingURL=dsse.d.ts.map

package/dist/workspace/trust/dsse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsse.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAA+D,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE1G,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,sFAAsF;AACtF,wBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhE;AAWD,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD;AAMD,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAKhF;AAID,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAGlH;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,kBAAkB,GAAG,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,eAAe,CAmBjG"}

package/dist/workspace/trust/evidence-cli.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `chant workspace evidence sign|verify` (#2553): runner evidence over the
+ * records a kind locates, in a DSSE envelope. See ./evidence.ts.
+ *
+ * `sign` runs in CI or in a service, with a runner key the policy at base
+ * lists. It refuses a key the signers file lists: evidence is a machine's
+ * statement, and a developer's key cannot make one. `verify` needs no
+ * network and no key, only the envelope and the repository.
+ *
+ * With `--json`, `verify` prints the `evidence.schema.json` document, and a
+ * refused `sign` prints its failure branch.
+ */
+import type { CommandContext } from "../../cli/registry.js";
+import { type DsseEnvelope } from "./dsse.js";
+import { type EvidenceErrorCode, type EvidenceStatement, type EvidenceVerdict } from "./evidence.js";
+export declare const EVIDENCE_CONTRACT_VERSION = 1;
+export declare const EVIDENCE_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/evidence/v1/evidence.schema.json";
+export interface EvidenceFailure {
+    code: EvidenceErrorCode;
+    message: string;
+}
+/** What `evidence verify --json` prints, and a refused `evidence sign --json`. */
+export type EvidenceDocument = ({
+    $schema: string;
+    contract: number;
+    chant: string;
+    at: string;
+} & Extract<EvidenceVerdict, {
+    ok: true;
+}>) | {
+    $schema: string;
+    contract: number;
+    chant: string;
+    at: string | null;
+    error: EvidenceFailure;
+};
+export declare function runWorkspaceEvidence(ctx: CommandContext): Promise<number>;
+export interface SignRequest {
+    repo: string;
+    /** The kind file, resolved against `cwd`. */
+    kind: string;
+    cwd: string;
+    keyPem: string;
+    checkId: string;
+    at?: string;
+    base?: string;
+    claim?: Buffer;
+    environment?: Buffer;
+}
+/**
+ * Build and sign evidence, or say why not. Refuses a key the signers file
+ * lists, and a key the policy at base does not list as a runner.
+ */
+export declare function signRecordsEvidence(req: SignRequest): Promise<{
+    envelope: DsseEnvelope;
+    statement: EvidenceStatement;
+    runner: string;
+} | {
+    error: EvidenceFailure;
+}>;
+/** Verify an envelope file at `at` against the runner keys at base, as the document `--json` prints. */
+export declare function verifyEvidenceFile(repo: string, envelopePath: string, opts?: {
+    at?: string;
+    base?: string;
+}): EvidenceDocument;
+//# sourceMappingURL=evidence-cli.d.ts.map

package/dist/workspace/trust/evidence-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-cli.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/evidence-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIzD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAsE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAGtK,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,yBAAyB,kFAAkF,CAAC;AAMzH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GACxB,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GAC3G;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AAqBpG,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/E;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,CA8ChH;AA2BD,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,gBAAgB,CAgBlI"}

package/dist/workspace/trust/evidence.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Runner evidence (#2553, #2524 D5 "Evidence").
+ *
+ * A runner, meaning a CI job or a service, states that a check ran over a
+ * set of records at one commit. The statement is an in-toto Statement v1:
+ * each record is a subject, named by its path and hashed, and the predicate
+ * binds the commit, its tree, the check, and the digests of the claim and of
+ * the environment when given. The runner signs it in a DSSE envelope with its
+ * own Ed25519 key.
+ *
+ * Verifying needs only the envelope, the repository's objects and the runner
+ * keys the policy at base lists, so it works offline. Evidence is never
+ * reused on trust: a verdict reports, subject by subject, whether the records
+ * still hash the same, and evidence for records that changed is `stale`.
+ */
+import { z } from "zod";
+import { type DsseEnvelope } from "./dsse.js";
+import type { KeyObject } from "node:crypto";
+import type { RunnerKey } from "./policy.js";
+export declare const STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+export declare const RUNNER_EVIDENCE_PREDICATE = "https://intentius.io/chant/runner-evidence/v1";
+/**
+ * Why evidence is refused, by `evidence sign` or `evidence verify` (#2553).
+ * Each is in `reason-codes.ts` and in `evidence.schema.json`. A sign or verify
+ * that can't read the record kind fails with the records read's own code.
+ */
+export declare const EVIDENCE_ERROR_CODES: readonly ["not-a-git-repository", "revision-unknown", "trust-policy-unreadable", "envelope-unreadable", "envelope-invalid", "envelope-untrusted", "evidence-payload-type", "evidence-statement-invalid", "evidence-runner-mismatch", "runner-key-invalid", "runner-key-is-signer", "runner-key-unlisted", "kind-unreadable", "kind-invalid", "schema-unreadable", "schema-id-mismatch", "schema-invalid", "location-missing"];
+export type EvidenceErrorCode = (typeof EVIDENCE_ERROR_CODES)[number];
+/** The statement a runner signs. Strict, so a verifier never acts on a field it does not know. */
+export declare const evidenceStatementSchema: z.ZodObject<{
+    _type: z.ZodLiteral<"https://in-toto.io/Statement/v1">;
+    subject: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        digest: z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    predicateType: z.ZodLiteral<"https://intentius.io/chant/runner-evidence/v1">;
+    predicate: z.ZodObject<{
+        runner: z.ZodString;
+        commit: z.ZodString;
+        tree: z.ZodString;
+        check: z.ZodString;
+        claim: z.ZodOptional<z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+        environment: z.ZodOptional<z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type EvidenceStatement = z.infer<typeof evidenceStatementSchema>;
+/** SHA-256 of a record's text, line endings normalised as seals do (#2524 D4). */
+export declare function recordHash(text: string): string;
+export interface EvidenceInput {
+    repo: string;
+    /** The full commit id the check ran at. Records are hashed as committed there. */
+    commit: string;
+    paths: string[];
+    runner: string;
+    check: string;
+    claim?: Buffer;
+    environment?: Buffer;
+}
+export declare function buildStatement(input: EvidenceInput): EvidenceStatement;
+export declare function signEvidence(statement: EvidenceStatement, key: KeyObject, publicKey: string): DsseEnvelope;
+export interface SubjectVerdict {
+    name: string;
+    signed: string;
+    /** The hash at the revision checked, or null when the record is not there. */
+    now: string | null;
+    matches: boolean;
+}
+export type EvidenceVerdict = {
+    ok: true;
+    /** `current` when every subject still hashes the same at the revision checked; otherwise `stale`. */
+    status: "current" | "stale";
+    runner: string;
+    class: RunnerKey["class"];
+    keyid: string;
+    statement: EvidenceStatement;
+    subjects: SubjectVerdict[];
+} | {
+    ok: false;
+    code: EvidenceErrorCode;
+    reason: string;
+};
+/**
+ * Verify an envelope against the runner keys at base, then compare each
+ * subject with the record as committed at `at`.
+ */
+export declare function verifyEvidence(envelope: unknown, runners: readonly RunnerKey[], repo: string, at: string): EvidenceVerdict;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/workspace/trust/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsD,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC/F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,eAAO,MAAM,cAAc,oCAAoC,CAAC;AAChE,eAAO,MAAM,yBAAyB,kDAAkD,CAAC;AAEzF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,+ZAmBS,CAAC;AAC3C,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKtE,kGAAkG;AAClG,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;kBA2BzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAkBD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,iBAAiB,CAmBtE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAE1G;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,eAAe,GACvB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,qGAAqG;IACrG,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,eAAe,CAmC1H"}

package/dist/workspace/trust/policy.d.ts

@@ -72,10 +72,33 @@ export declare const trustConfigSchema: z.ZodObject<{
         to: z.ZodString;
         note: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
+    runners: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        principal: z.ZodString;
+        class: z.ZodEnum<{
+            runner: "runner";
+            service: "service";
+        }>;
+        key: z.ZodString;
+    }, z.core.$strict>>>;
+    admitted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        return: z.ZodString;
+        signers: z.ZodArray<z.ZodObject<{
+            principal: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strict>>;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type TrustConfig = z.infer<typeof trustConfigSchema>;
 /** The role whose holders may change the policy. Without any grant of it, every signer may. */
 export declare const ADMIN_ROLE = "admin";
+/** A key that signs runner evidence: a service or CI identity. */
+export interface RunnerKey {
+    principal: string;
+    class: "runner" | "service";
+    /** `ssh-ed25519 <base64>`. */
+    key: string;
+}
 /** The policy a check applies, as read at base. */
 export interface TrustPolicy {
     /** The full commit id the policy was read at, or null when there is no base. */
@@ -91,10 +114,34 @@ export interface TrustPolicy {
         from?: string;
         to: string;
     }>;
+    /** Runner and service keys that may sign runner evidence (#2553). */
+    runners: RunnerKey[];
+    /** Runner entries that are not used, and why. */
+    excludedRunners: Array<{
+        principal: string;
+        reason: string;
+    }>;
+    /** Signers admitted per return (#2552), keyed by return id. They verify that return's commits and seals only. */
+    admitted: Record<string, Signer[]>;
+    /**
+     * Set on a copy of the policy used for one returned record (#2552): the
+     * return it came back in. A seal by a principal the policy does not list
+     * then reads as unverifiable rather than unlisted, until an admin admits
+     * the signer. Never set on the policy read at base.
+     */
+    returnedFrom?: string;
     /** Why the policy could not be read, when it could not. Nothing verifies then. */
     problems: string[];
+    /**
+     * The signer set in effect at a commit's position in the base's history
+     * (#2553). Absent, every commit is judged by `signers`.
+     */
+    signersAt?: (commit: string) => {
+        version: number;
+        signers: Signer[];
+    } | null;
 }
-/** Paths whose change is a protected write under `policy`. */
+/** Paths whose change is a protected write under `policy`: the config, the signers file and its rotation file (#2553). */
 export declare function protectedPaths(policy: TrustPolicy): string[];
 /** Principals allowed to change the policy: the admins when any are granted, otherwise every signer. */
 export declare function policyWriters(policy: TrustPolicy): Set<string>;
@@ -106,6 +153,12 @@ export declare function emptyPolicy(base: string | null, problems?: string[]): T
  * its problems listed, so nothing is attested (fail closed).
  */
 export declare function readTrustPolicy(source: RecordSource, base: string | null): TrustPolicy;
+/**
+ * The policy for work that came back in return `id` (#2552): the signers at
+ * base plus the ones admitted for that return, marked with the return so a
+ * seal by an unknown signer reads as unverifiable.
+ */
+export declare function returnedPolicy(policy: TrustPolicy, id: string): TrustPolicy;
 /** A file's text through `source`, or undefined when it is not there. */
 export declare function readOptional(source: RecordSource, path: string): string | undefined;
 //# sourceMappingURL=policy.d.ts.map

package/dist/workspace/trust/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAe7D,uEAAuE;AACvE,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAmDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAkD3D;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9D;AAcD,eAAO,MAAM,iBAAiB;;;;;;;;;kBAiBnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+FAA+F;AAC/F,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,kFAAkF;IAClF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAE5D;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAI9D;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,WAAW,CAErF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CA8BtF;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnF"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAe7D,uEAAuE;AACvE,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAmDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAkD3D;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9D;AAcD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;kBA4DnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+FAA+F;AAC/F,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,qEAAqE;IACrE,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,iHAAiH;IACjH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/E;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAG5D;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAI9D;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,WAAW,CAErF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAiDtF;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAE3E;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnF"}

package/dist/workspace/trust/provenance.d.ts

@@ -21,6 +21,16 @@ export interface RecordProvenance {
     principal?: string;
     key?: string;
     reason: string;
+    /**
+     * Set when the content came back in a return (#2552): the return's id, the
+     * commit in the returned copy that the level judges, and the commit here
+     * that holds the content. `commit` above is that commit here.
+     */
+    returned?: {
+        id: string;
+        commit?: string;
+        importedIn: string | null;
+    };
 }
 /** Where the base revision came from. */
 export type BaseSource = "flag" | "origin/HEAD" | "main" | "master";
@@ -36,7 +46,11 @@ export interface ResolvedBase {
  * `HEAD`, which is the change under review.
  */
 export declare function resolveBase(repo: string, explicit?: string): ResolvedBase;
-/** The policy at `base`, or an inactive one when there is no base. */
+/**
+ * The policy at `base`, or an inactive one when there is no base. With a
+ * signers file, its history is verified too (#2553): every version must be
+ * signed by a threshold of the one before, or nothing verifies.
+ */
 export declare function policyAtBase(repo: string, base: ResolvedBase): TrustPolicy;
 /**
  * The last commit reachable from `rev` that changed each path. Merges are
@@ -58,6 +72,12 @@ export interface ProvenanceQuery {
     at: string | null;
     paths: string[];
     attestors: readonly CommitAttestor[];
+    /**
+     * A second look at each committed path, given the provenance of the commit
+     * that holds it here. Returned work (#2552) uses it to judge the commit the
+     * content was made in, which a return carries. Undefined keeps the answer.
+     */
+    revisit?: (path: string, host: RecordProvenance) => RecordProvenance | undefined;
 }
 /**
  * The provenance of each path. With attestation off (no signers file at

package/dist/workspace/trust/provenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAE1E,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAczE;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,WAAW,CAG1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3F;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYrE;AAWD,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,kDAAkD;AAClD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,gBAAgB,CAa1I;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAyBlF"}
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG1E,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAczE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,WAAW,CAW1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3F;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYrE;AAWD,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,kDAAkD;AAClD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,gBAAgB,CAwB1I;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,SAAS,CAAC;CAClF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CA0BlF"}